Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2023, 09:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://clicks.email-hamptonlovett.co.uk/email/S-191500@3744674@cmunlIW7DGbK4URodsa9wWSZITNaewIYvwDpLXMAgXs.@
Resource
win10v2004-20230220-en
General
-
Target
https://clicks.email-hamptonlovett.co.uk/email/S-191500@3744674@cmunlIW7DGbK4URodsa9wWSZITNaewIYvwDpLXMAgXs.@
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "652657844" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{520AE1D8-FBB8-11ED-9EF6-6E21A4042E2D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30ad482cc58fd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000de7b9f4528afa4b93733dcd7d6b545e00000000020000000000106600000001000020000000ba72fb240fba4d65ab9b6dd4fddb125534dd9ee296e4803a0093890566b059f7000000000e8000000002000020000000cc46a96ca529dede5f55a6df2dba83f66114c33510d59668c87d412dcbc094a320000000ee948280c6e188346d3d8277fd0fea841e4666fe0b5c27f8f19d4f2f068668d24000000032a1563ebdc35c24444dcdb68c8bbc72a3608b6a9ce83ba082f216612849c477752f56d14982f9f9786b379623eaec6b8d8869ef84e80e52630bc6ce3d81c144 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31035333" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000de7b9f4528afa4b93733dcd7d6b545e000000000200000000001066000000010000200000003fa326ca7a4695c5e333acddc13488ea01135f27a4c066beac88402973f17699000000000e8000000002000020000000209f7652b22030b78531436e0cf170c074ea91c356f7dc1a0e8fecbef6b1e70220000000247aefacdd3f9b386855480d177dc0da6e98cccb07b845c0def34aec1d36916d40000000309fdc3f035e084f086a6e7aa701c6c3d8ff4310eb64893b44242084c1b1925a8c07394862f4b078ca3250bcb8d03a305bda519e6aefc8634b429cdc941e717c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000de7b9f4528afa4b93733dcd7d6b545e000000000200000000001066000000010000200000004b5a96d564f4537ead71dcf5b874b8f3b6ffb1a2c9f009ea8ebb930513a4ca5d000000000e8000000002000020000000db350a45214f2dd1bcd9e9d95830f578c5bc8843bf6770c393a84b1bbfbc75142000000009bd5861b55475b02999ec3b974017d1429f0ed4d053829d3eac1d7b01c2027a40000000531527f5b9371ed712afa525b8660cc4ff1440eabac563061dacaf97e1ad7b1c6eb83f7a95096635513c264c19357a8c253a3bd78a8d555e4c600f2847cf8b2a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "652657844" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c7a76ac58fd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "391865434" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31035333" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "664846639" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31035333" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0cd672cc58fd901 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1308 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1308 iexplore.exe 1308 iexplore.exe 3736 IEXPLORE.EXE 3736 IEXPLORE.EXE 3736 IEXPLORE.EXE 3736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1308 wrote to memory of 3736 1308 iexplore.exe 85 PID 1308 wrote to memory of 3736 1308 iexplore.exe 85 PID 1308 wrote to memory of 3736 1308 iexplore.exe 85
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://clicks.email-hamptonlovett.co.uk/email/S-191500@3744674@cmunlIW7DGbK4URodsa9wWSZITNaewIYvwDpLXMAgXs.@1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1308 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3736
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD53b2daafe6506b789e6b8b0a9c4eb42cc
SHA1da166c0ddf9e4065561b8849c8a841148797bd46
SHA25665c2f718c41a8b2a8bfa7709fcd48d70ec0546c7e8ff80d83076fec0d8db1943
SHA5122398cb5a868b7fc6638531994ffb1f149db0f231e89fcdc53e4d5a0b44c81cb12aed855675893e27e3b5b48a3e2e10076d403bb697a3319af702ddff62de4173
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD587cc54c982e96e32a82ad939daf852a0
SHA1270517169768c3c194e65d3b2b04c888b2158cc9
SHA256c4a79642ba9d2f1c30cdacc5c206801e37bb88b6a886e7fd1c8852edf1272cad
SHA512c05febfc759f5def12795176a1ba746da5c6db5677b43220154fc9b08de28025cff92104afa5feafa1dc8a64f67d23f15f1d45c3247c281ea0c9e33c4612f884
-
Filesize
11KB
MD52432018cc2b50a13c322ea26d4e9b820
SHA1f378c4a6c804fa222dc2006f9cd5113d2ed78ea2
SHA25607b67241cca6d11f55205bfc151aadcbc74cf30fdd519c98fd1e7ada8915f14c
SHA512cd3d3a7423e918273edd7bcf95f139d11c632b6d39722ae7232c97df31cfe39988925b12ab94bd8d53468115d7655fcfcbe55b46f5f33550aa83b8345cbeee60
-
Filesize
5KB
MD55d3ff3c3fbaa67cc639501f44eeb07be
SHA1bd66e4cd58de09c198e7abc77fa4c883955d189e
SHA2562249399b2268c260d0698542503d16afebc80e437c846239f12196744ebbd40f
SHA51296d7ae443f9a50436b64f4d758544f4c17030f120659ee6ebb46a93c49fedd92980f00da104ac82bdaef474433506994439e4a144d91a864d5a19b0a72d18c57
-
Filesize
3KB
MD5f9faba678c4d6dcfdde69e5b11b37a2e
SHA181a434f94f2b1124f3232bb86f2944f82fb23ac0
SHA2567adaf08052c6a6a0f8a0d0055b4f191fd07389fe41c972b69573472b2ecb406a
SHA512ea52d475e439ba178c15b5a6dc23f6ef5975e11b17d71b71f89e71db27880e49220697954cd853aa28cc13b1a044a2a2ea10aaa2fc02a014e5441102db433c32
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
54KB
MD56895e8cd60b62646ce12426015888f58
SHA1de908c9ed184d74eb525fa7a30449b67fc3a1c14
SHA256eb795deda8983fa5310627c9584cf3f3b95d272567113500059018b3941cb267
SHA512f43dfd388488b509a66879608c35d7c1155f93dcec33ca875082f59f35552740d65e9a344a044d7ec534f0278a6bb6f0ed81047f73dcf615f7dcd76e0a482009
-
Filesize
5KB
MD5632c2740d954c19986c0355ab7affed3
SHA13d8d8b9a9805cddbc08a09e34347f38c8f22c5af
SHA256887bd68d803152aff855626aac02d463ee5fe19c59da792fae8649caa196b8d1
SHA51274b123febb464f2981e6d9a9a9cee3020d383410f773f9fa6bcd52d7d123c669d3d8183a23b669d7a06223085edfc4cf62994077205679c262e787a8e65edfe3
-
Filesize
8KB
MD5edb0eda69b9a6429f463b0fb66bb0b30
SHA14d6797755d555ae88b43e5df0e42f8dec1a0597e
SHA25634f49ddea2d1ed9e782a8b8578b51c5e841d5d2a8fb60b03076b17569351116d
SHA5123e77a51488aaeb0c2e022cc3c5fa596f663c456cfc5cd5adefbdb724f660e8d5fb4acebccb666091c6fcaa6ec342794ac335b172774d67080db1323d3ce99477
-
Filesize
84KB
MD54b57cf46dc8cb95c4cca54afc85e9540
SHA105e1ad0cc600a057886deaf237ab6e3d4fcdb5ac
SHA256a28ccf8a7b50522bdeea0cd83cdeca221c18fc1f9df3ee6b3d3c48d599206855
SHA512a6996f5029858c6de6de30eda54f8acc47d9713cb1adc576173ce8f75f79a2b944b9c04bfa55ad62829e705cede4fcb7c7c90785e8cd3e0252d79a186b1760a7
-
Filesize
1.0MB
MD5d3214e1b0b2e12fd9ae6dd2fed205c02
SHA1dade44343b59b4ac0ff235b3d6e69c78f5ecc73c
SHA256842167a0460927b7d7f28e8ada521439a4cab7f0137af4191796204e290bd654
SHA512638e59093a204b3bf7e6cfdceb13f77a6c8a4112c7afd1c9ca9cb5893873be6c7f4c531a12788cf50b1e57998012a4016febddaa3f7c5a670e337b2ecc97366c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\LDIcapOFNxEwR-Bd1O9uYNmnUQomAgE25imKSbHhROjLsZBWTSrQGL_kVtKF6w[1].woff
Filesize18KB
MD5f5b188e36d07ae143b1a454d39b69bc6
SHA17fa400ac55ab5bdabd29609db2dfb281bfed4b83
SHA2567b21fc25df12d820074a5bba41daf8c6e035faa4f35f5cf593bc8f44051c4107
SHA512a91d096c1b769b097b10e2cfdce154bc9ffde825a7c0435d2b0d5c03dcc4904c9d61392b42d8079e3a26c8acbf7dccf6d9a7701cce0ebd8f9e797bb74d605e51
-
Filesize
750B
MD51391e9f62b1bbb6a4fa84aecd2a9f9dc
SHA1b2650961251af8f769c544bc4a33b53fc4f8a5ab
SHA256cddddc16db59bb85188d4491ba339bff9194a28bef473023840953506dc3e2ed
SHA51212b9ece0d4562e65f31e7f96902079bfc986eee62167219e4ff8c9c6f1b20c87b8c878263dc33984ce51b9e409152ef8797742d61cc255c4f9d4b34414f0aae6
-
Filesize
9KB
MD5cd2247b8c662be9253d6c3920106ff7f
SHA1fac968e2b300119dcec736ad6fd9c7fa6b387e7e
SHA2568c59512147c089ad0de05acba5bacda7d22e9e7a41881d53ea706e61b4c532c4
SHA512e1af129a3f8c1c7b2d40f2705b9340deb5066d85694782a95712be96f34c18c0ad503b58dad3833abde0b85745a65ed219a2396d93444c3c00b195b948d43fe1
-
Filesize
1KB
MD5f38b2db10e01b1572732a3191d538707
SHA1a94a059b3178b4adec09e3281ace2819a30095a4
SHA256de1e399b07289f3b0a8d35142e363e128124a1185770e214e25e58030dad48e5
SHA512c11e283612c11dfeec9a3cb42b8a2acdd5ae99dfabe7ffba40efef0dd6bbe8c5b98ae8383d3eeff3a168124c922097eddd703401ee9ac6122f1ebab09bbf7737
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\LDIcapOFNxEwR-Bd1O9uYNmnUQomAgE25imKSbHhROjLsZBWTSrQGFPjVtKF6w[1].woff
Filesize18KB
MD5940c9bc5fce4faec6a8c89e73e57c7c9
SHA12402d98256697fbecdc1f721671ff2f26bc5c4db
SHA2569bb47a09b91a2aab99c92ba808d2652d75b4828eeb8ffba3e281e1ea4320c24d
SHA5125d0463c839f62fbd50e1d8705c315b1ae7b42d7e628bfebe09f0eac63d0d095128959c479da2d7b54032529ceb9a71e0571c87fd0f2cdbbd840d1a095c4f315b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\LDIcapOFNxEwR-Bd1O9uYNmnUQomAgE25imKSbHhROjLsZBWTSrQGGHjVtKF6w[1].woff
Filesize18KB
MD544d5e7759fe2c81c884b1a0344f7d903
SHA11999f891229b30b66e0f9cc43bbd6e1be4e3c164
SHA2561417f6dc267b952bc9017bac2261191489c2dfdfd4015c274f8ab7919fc08f33
SHA512f6dc6cc603d7a0f983443d2db68758a966451bc37a39afb28537c0404518e91a1f52b3f242533915359cc04fd1dabd0fda6e205786179b675065d483497b7b56
-
Filesize
149KB
MD5f411c136e2bb302ada2120b3eb1d5bc3
SHA13ae9bb0e7929489abd23736ae892939c8fe98645
SHA2566b3bef53dc4a96ec07149d02a60b5fd026332bbce0b4ece79f3c55e3ddb85f5c
SHA51273c0081669f87b45999da4ce0974ce2f347eb88ad310b63d01e22e52ae8e0c668eeb5f418ea1b6ae18afff2e9d21d98cedb6be0a9ccc464933b4c3d77d5066f6
-
Filesize
30KB
MD52cc3ab6c0c8b8b7103a3a8673ec9eb56
SHA1968ea6255a4d051df32485ca3f7e843115454ee7
SHA256882146362bbda5e9239e3f72f1f25287ab01bf65ff9f0f66ef21cb6b39612be1
SHA5127f1544a7faa7beb73aed19aa9e1ff94d154f997a300dbc9235185c55b33f18af7b8966264b252cc6d5269f9309d5969b66cc5f7f412a85efc8af8e5404323b84